Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    62s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260705-ca61csgv3z
  • SHA256 745bbf048c16a84439476075bdec5786448d49c7c3f4431736c62ce661b62bcc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • cakhia-wc2026.com

  • malware.cakhia-wc2026.com

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5496
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yePquODfMJ4T.bat" "
      2⤵
        PID:1288
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:2712
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:2032
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VH4PDRZJgfBx.bat" "
                4⤵
                  PID:5724
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:1292
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:2892
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9dxCOmapvjun.bat" "
                          6⤵
                            PID:1976
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:2608
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:5352
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pZldLyKPVm8e.bat" "
                                    8⤵
                                      PID:5592
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:2016
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:264
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mk5IwCcekHvu.bat" "
                                              10⤵
                                                PID:4528
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:900
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:2372
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dqqCHJzD3cOY.bat" "
                                                        12⤵
                                                          PID:4852
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:4480
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:1504
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KjjQTShK96ED.bat" "
                                                                  14⤵
                                                                    PID:2108
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:4732
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:4436
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DEb5MOtQZZ95.bat" "
                                                                            16⤵
                                                                              PID:2860
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:3448
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:5528
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZsJjQFoXIOUK.bat" "
                                                                                      18⤵
                                                                                        PID:4740
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:5028
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:3232
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WV6tgCNcqr9E.bat" "
                                                                                                20⤵
                                                                                                  PID:6092
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:3216
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:1308
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g3fwh0LsMyEg.bat" "
                                                                                                          22⤵
                                                                                                            PID:2880
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:4456
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:6112
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cAznRcrD0f1h.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:5992
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:5392
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:1780
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\olxPRO7DLzrW.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:2364
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:2004
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:5156
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JyqoDa0wAIWJ.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:1452
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:4836
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:2756
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RxjbNRY3M2bm.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:1356
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:2276
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:416
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ODiTDfg603ax.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:2396
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:3572
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:1876
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xx0XoDeTz5p0.bat" "
                                                                                                                                                                      34⤵
                                                                                                                                                                        PID:240
                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                          chcp 65001
                                                                                                                                                                          35⤵
                                                                                                                                                                            PID:1052
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                            35⤵
                                                                                                                                                                              PID:900
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ui3x4ef92nGa.bat" "
                                                                                                                                                                                36⤵
                                                                                                                                                                                  PID:4924
                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                    37⤵
                                                                                                                                                                                      PID:568
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                                      37⤵
                                                                                                                                                                                        PID:5628
                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                sihost.exe
                                                                                                                1⤵
                                                                                                                  PID:3320
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe /LOADSAVEDWINDOWS
                                                                                                                    2⤵
                                                                                                                      PID:2420
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2620
                                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                      1⤵
                                                                                                                        PID:5176

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Matrix

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            9dxCOmapvjun.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\9dxCOmapvjun.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 940245b9b1ff90e081f32b451f1f29cafbbdff08cfe0a6ba7d878dc259f1a181
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            DEb5MOtQZZ95.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\DEb5MOtQZZ95.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 ba297c0966af5b4418f05119ae8ac71a08baa88b8d14e900d48748165e12c542
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            JyqoDa0wAIWJ.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\JyqoDa0wAIWJ.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 1a5d2bb90d6167456e3026661458780198d6203df5b16e1347d0f6b36dbb8640
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            KjjQTShK96ED.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\KjjQTShK96ED.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 7b72614ce3be507740d34fbd9fb4a5c196cf7dca78b60cb4ee641621cf18580e
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ODiTDfg603ax.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ODiTDfg603ax.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 78f03c06c78dfd79f624501c4479078dcbc7f41fcdcaf073afe5ef08b28e5d48
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            RxjbNRY3M2bm.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RxjbNRY3M2bm.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 a059d8cc4fb8d06ceca5b5f9271e67d659ba884a241e0c64fe057d1f81b71911
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            Ui3x4ef92nGa.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Ui3x4ef92nGa.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 9114cee6ba8b417fa69162e68928be4c1fab407f8b31f20a5352dab92ce1efbd
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            VH4PDRZJgfBx.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\VH4PDRZJgfBx.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 e3656a7651055ff87e4eba196239f7bc66f34dfe2735b9e76e36b7167daddd6f
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            WV6tgCNcqr9E.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\WV6tgCNcqr9E.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 04e7e5bdbc9da8b0d6eda632c314d7cad0d2e9014c41f6aac2c87a22428655d8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            ZsJjQFoXIOUK.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ZsJjQFoXIOUK.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 cad6ae95aa00e8d49f8f08a7c4bdbf44683cc39a46312d4102810f9751f7ec0a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            cAznRcrD0f1h.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\cAznRcrD0f1h.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 b6c9f7a71dc9cd0ecd03c21646f3b296a175b5dbf1f0a4841feadb522e2cf5fc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            dqqCHJzD3cOY.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\dqqCHJzD3cOY.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 2ca823daeceb3c6b74bb61f53f9492d446a149afa89ad4e080ad4db3904b35d5
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            g3fwh0LsMyEg.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\g3fwh0LsMyEg.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 1df65a8396b1578337202cc0e24bd7a0ac8a7539b553e70ea86a5d521c105eba
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            mk5IwCcekHvu.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\mk5IwCcekHvu.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 c11a4cee70473efdff3d9f3ff4fda445ae346022082f35988fe2db47e9419727
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            olxPRO7DLzrW.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\olxPRO7DLzrW.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 9ba489ff12d1c1ce7374276ee234ee102faba0796d4311d321fec187bd9059e3
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            pZldLyKPVm8e.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\pZldLyKPVm8e.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 bc0eb2bf7eb90a1c21b537222f45d8644bcee64ae065139141008850d42ebc3a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            xx0XoDeTz5p0.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\xx0XoDeTz5p0.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 86d4b458e75620ac707e549ee8ec29d867c525240aed6b475363e8accb6b2926
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            yePquODfMJ4T.bat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\yePquODfMJ4T.bat
                                                                                                                            • Size 185B
                                                                                                                            • SHA256 c1d2848f1677f9b489a3a5755d96d4fbda2e1e69d5ac4c7078bd627b435d07a8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/2032-30-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-24-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-27-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-26-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-28-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-29-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-25-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-31-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-32-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-33-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-34-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-35-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-36-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-23-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2032-43-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-8-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-7-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-14-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-13-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-12-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-11-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-22-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-10-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-0-0x00007FFE310FF000-0x00007FFE31100000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-9-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-6-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-5-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-4-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-3-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-2-0x00007FFE30F70000-0x00007FFE31914000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5496-1-0x00000000003D0000-0x00000000006FC000-memory.dmp
                                                                                                                            Download